The Zyosoft School App contains an insecure direct object reference flaw that lets authenticated, remote attackers change a request parameter to read or rewrite data belonging to other students, teachers, or administrators. This weakness, identified as CWE‑639, indicates that the app does not enforce proper ownership checks before allowing access to user data. Consequently, an attacker can compromise the confidentiality and integrity of the platform’s personal records, leading to potential privacy violations and manipulation of academic data.

All earlier releases of Zyosoft School App for Android and iOS are affected. Versions prior to 1.1.62 on Android or 2.7.2 on iOS do not contain the necessary authorization checks and remain vulnerable. Users should verify that their mobile application is at least these minimum versions to mitigate the risk.

With a CVSS score of 8.6, the vulnerability poses a high risk for compromised accounts. The EPSS score is not available, but the lack of a CISA KEV listing suggests no widely known public exploits yet. Attackers would need authenticated access, typically provided by a valid user account or through credential compromise. Once authenticated, the attacker can modify request parameters to reference other users’ identifiers, bypassing intended access controls and illicitly reading or updating their data.